dtoro/oikos

Fork 0

Files

dtoro d80a394b7f

ci / build-test (push) Has been cancelled

Details

ci / docker-build (push) Has been cancelled

Details

docs: fix plan/repo drift, retire dead Goose+Nomos and Caveman tooling

Documentation and repo-hygiene pass following the client/server split:

Plan drift (audited all other active plans against current code):
- oikos-gaps-and-improvements.md: mark Section C and D.5 resolved (both
  described cmd/hermes, renamed to cmd/nomos with a real LLM loop since);
  refresh ~10 stale file:line citations; fix tool-count (33, not 28).
- liveness-drift-and-ux-cohesion.md: fix stale default-model claim (now
  deepseek-v4-pro since 2026-07-10) and "not yet deployed" status.
- nomos-agent-code-review.md: fix C1's citation (one unauthenticated route
  to nomos now, not two, after the client/server split).
- wails-desktop-app.md: record the production deploy outcome.

Repo structure: added missing directories to README/CONTRIBUTING layout
tables (checks/, tools/, cmd/webhook/, docs/operations/), fixed a broken
link, added ADR 0015 documenting the auth/CORS/client-split model (there
wasn't one despite CONTRIBUTING's own process requiring it), normalized
ADR 0013/0014's format drift, added an Authentication section to
AGENTS.md/CLIENTS.md (every example call was missing the now-required
bearer header).

Retired the Goose+Nomos workstation flow (bootstrap.sh --with-nomos,
tools/setup-nomos-soul.sh, .agents/operations/nomos-agent.md) and the
Caveman auto-install tooling (tools/setup-caveman.sh, tools/caveman/) —
both superseded by the production containerized Nomos agent, which has
never used either. Kept .agents/shared/caveman.md itself (the terse
writing-style convention agents still follow by reading it).

Deleted the orphaned legacy Python oikos/ directory — nothing imports it,
and bin/homelab (the CLI it was kept for) no longer exists in the repo.

Rewrote .agents/operations/agent-enrollment.md (365 -> ~110 lines) and
commands.md to match the current architecture instead of the retired
`homelab` CLI; migrated the still-true networking prerequisites (Netbird,
split-horizon DNS, SSH key distribution) into the knowledge base as a
runbook via upsert_knowledge rather than duplicating them in markdown.
Updated all 10 .agents/skills/ runbooks referencing the dead CLI with
their real MCP tool / REST API equivalents, or flagged them as needing
verification where no equivalent is confirmed yet.

Two real bugs found and fixed, not just docs:
- The tools/setup-*.sh auto-setup glob was tools/*.setup.sh in THREE
  places (tools/post-pull.sh, bootstrap.sh, and internal/httpapi/impl.go's
  GetClientContext handler) since the mechanism's introduction on
  2026-06-02 — never matched any real filename, so no client has ever
  picked up an auto-setup script via git-pull or the context-poller sync.
  Fixed all three; the Go server-side fix is the one that actually matters
  since it's what the current context-poller mechanism depends on.
- bootstrap.sh removed dead vestigial --gitea-token/--gitea-user flags
  (parsed, never consumed) left over from an earlier clone-based model.

Also flagged, not fixed (documented as an open gap in
client-enrollment/SKILL.md): bootstrap.sh tells a freshly-enrolled client
to call POST /api/v1/clients/{slug}/activate to finish enrollment, but
that route doesn't exist in api/openapi.yaml — EnrollClient sets entities
to provisioning and nothing currently transitions them to active.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-12 18:19:41 +02:00

2.5 KiB

Raw Blame History

name, risk_class, inputs, verification, docs_update_checklist, transition

name

risk_class

inputs

verification

docs_update_checklist

transition

lifecycle-destroy-node

destructive

node_name

MCP get_blast_radius returns unknown-entity; pct list on the backend no longer shows it

archaeology_entry

containers_index_update

deprecated -> destroyed

Lifecycle: destroy a node

Destructive. Requires operator approval + typed confirmation phrase per seeds/policy.yaml. Requires (ontology): backups verified, secrets recipients removed + re-keyed, ingress/DNS removed, archaeology entry, ledger entry.

Confirm the node is deprecated with zero affected_by edges (MCP get_blast_radius) — do not skip this even if the deprecation runbook was followed recently; state can drift.
If it's an enrolled client: no current tool for revoking its age key / removing its Infisical identity. The old homelab client remove (age key revocation + SOPS re-key + inventory removal, all one destructive-class CLI call) is retired along with the rest of that CLI and hasn't been re-verified against the current enrollment architecture (POST /api/v1/clients/enroll + Infisical machine identities) — see the "Open questions" section in agent-enrollment.md. Until that's confirmed, treat key/identity revocation as a manual step: at minimum remove the client's age_pubkey from any SOPS recipient lists and rotate credentials whose ciphertext it already decrypted.
Remove any ingress route (Caddy config repo) and DNS record still pointing at it.
Verify backups of anything on it are retained per policy before the disk goes away (see backs-up-to).
Destroy the LXC/VM (pct destroy / qm destroy).
Update the entity's state to destroyed in seeds/inventory.yaml (or move it to an archaeology:-style section if the schema still has one) — pve_id, destroyed date, reason — then oikos seed to ingest. Add a row to containers/index.md "Recently destroyed" table (kept for human-readable browsing alongside the structured data).
No manual ledger step — mutations through the API are recorded automatically in the audit_log table (MCP get_audit_trail, get_change_history). The old oikos/ledger.py append was retired when this became automatic.

If the destroy fails partway (e.g. secrets not fully revoked but pct destroy errors), finish the remaining steps manually and note the partial state in an investigation (MCP upsert_knowledge, kind: investigation).

2.5 KiB Raw Blame History

Lifecycle: destroy a node

2.5 KiB

Raw Blame History